sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-05 21:19:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add known mark to identity, fix credentials comparison bugs

Browse Source
This commit is contained in:
Theodor S. Midtlien
2026-09-08 12:01:30 +02:00
parent 8238e08597
commit b2f7eacd34
21 changed files with 350 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/internal/ipcauth/privileged_test.go
+49 -60
View File
@@ -9,96 +9,85 @@ func TestIsPrivilegedCaller_SelfRule(t *testing.T) {
tests := []struct {
name string
// self stands in for the process the daemon runs as.
self Identity
selfKnown bool
caller Identity
want bool
self Identity
caller Identity
want bool
}{
{
name: "root is privileged whatever the daemon runs as",
self: Identity{UID: 1000},
selfKnown: true,
caller: Identity{UID: 0},
want: true,
name: "root is privileged whatever the daemon runs as",
self: Identity{known: true, UID: 1000},
caller: Identity{known: true, UID: 0},
want: true,
},
{
name: "an unprivileged daemon delegates to its own user (rootless container)",
self: Identity{UID: 1000},
selfKnown: true,
caller: Identity{UID: 1000},
want: true,
name: "an unprivileged daemon delegates to its own user (rootless container)",
self: Identity{known: true, UID: 1000},
caller: Identity{known: true, UID: 1000},
want: true,
},
{
name: "an unprivileged daemon delegates to nobody else",
self: Identity{UID: 1000},
selfKnown: true,
caller: Identity{UID: 1001},
want: false,
name: "an unprivileged daemon delegates to nobody else",
self: Identity{known: true, UID: 1000},
caller: Identity{known: true, UID: 1001},
want: false,
},
{
// The daemon is root on a normal install, so sharing its identity is
// already covered by being root; nothing else may match.
name: "a root daemon delegates to nobody",
self: Identity{UID: 0},
selfKnown: true,
caller: Identity{UID: 1000},
want: false,
name: "a root daemon delegates to nobody",
self: Identity{known: true, UID: 0},
caller: Identity{known: true, UID: 1000},
want: false,
},
{
// Windows netstack mode: the daemon needs no administrator rights.
name: "an unprivileged windows daemon delegates to its own SID",
self: Identity{SID: "S-1-5-21-1-2-3-1001"},
selfKnown: true,
caller: Identity{SID: "S-1-5-21-1-2-3-1001"},
want: true,
name: "an unprivileged windows daemon delegates to its own SID",
self: Identity{known: true, SID: "S-1-5-21-1-2-3-1001"},
caller: Identity{known: true, SID: "S-1-5-21-1-2-3-1001"},
want: true,
},
{
name: "an unprivileged windows daemon delegates to no other SID",
self: Identity{SID: "S-1-5-21-1-2-3-1001"},
selfKnown: true,
caller: Identity{SID: "S-1-5-21-1-2-3-1002"},
want: false,
name: "an unprivileged windows daemon delegates to no other SID",
self: Identity{known: true, SID: "S-1-5-21-1-2-3-1001"},
caller: Identity{known: true, SID: "S-1-5-21-1-2-3-1002"},
want: false,
},
{
// The UAC boundary: a filtered and a full token of the same account
// carry the same SID but not the same power, so an elevated daemon must
// never delegate to its own SID.
name: "an elevated windows daemon does not delegate to its own SID",
self: Identity{SID: "S-1-5-21-1-2-3-500", Elevated: true},
selfKnown: true,
caller: Identity{SID: "S-1-5-21-1-2-3-500"},
want: false,
name: "an elevated windows daemon does not delegate to its own SID",
self: Identity{known: true, SID: "S-1-5-21-1-2-3-500", Elevated: true},
caller: Identity{known: true, SID: "S-1-5-21-1-2-3-500"},
want: false,
},
{
name: "LocalSystem is privileged on its own merits, not by delegation",
self: Identity{SID: sidLocalSystem},
selfKnown: true,
caller: Identity{SID: sidLocalSystem},
want: true, // LocalSystem is privileged on its own merits
name: "LocalSystem is privileged on its own merits, not by delegation",
self: Identity{known: true, SID: sidLocalSystem},
caller: Identity{known: true, SID: sidLocalSystem},
want: true, // LocalSystem is privileged on its own merits
},
{
name: "identities of different kinds never match",
self: Identity{UID: 1000},
selfKnown: true,
caller: Identity{SID: "S-1-5-21-1-2-3-1001"},
want: false,
name: "identities of different kinds never match",
self: Identity{known: true, UID: 1000},
caller: Identity{known: true, SID: "S-1-5-21-1-2-3-1001"},
want: false,
},
{
name: "an unknown self identity delegates to nobody",
self: Identity{},
selfKnown: false,
caller: Identity{UID: 1000},
want: false,
name: "an unknown self identity delegates to nobody",
self: Identity{},
caller: Identity{known: true, UID: 1000},
want: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
prevID, prevKnown, prevDelegate := selfIdentity, selfKnown, selfMayDelegate
t.Cleanup(func() { selfIdentity, selfKnown, selfMayDelegate = prevID, prevKnown, prevDelegate })
prevID, prevDelegate := selfIdentity, selfMayDelegate
t.Cleanup(func() { selfIdentity, selfMayDelegate = prevID, prevDelegate })
selfIdentity, selfKnown = tt.self, tt.selfKnown
selfMayDelegate = tt.selfKnown && !tt.self.IsPrivileged()
selfIdentity = tt.self
selfMayDelegate = tt.self.Known() && !tt.self.IsPrivileged()
if got := IsPrivilegedCaller(tt.caller); got != tt.want {
t.Fatalf("IsPrivilegedCaller(%v) with daemon %v = %t, want %t",
@@ -124,9 +113,9 @@ func TestIsPrivilegedCaller_ThisProcess(t *testing.T) {
// A caller that is neither root nor this process must be refused, whatever
// this process happens to be.
other := Identity{UID: id.UID + 1}
other := Identity{known: true, UID: id.UID + 1}
if id.IsWindows() {
other = Identity{SID: id.SID + "9"}
other = Identity{known: true, SID: id.SID + "9"}
}
if IsPrivilegedCaller(other) {
t.Errorf("an unrelated identity %v was treated as privileged", other)